зеркало из https://github.com/getsops/sops.git
Revert "Match file path relative to config file's directory (#827)"
This reverts commit dd7ce3d2cb.
This commit is contained in:
Adrian Utrilla
GitHub
Родитель
dd7ce3d2cb
Коммит
c178f89662
|
|
@ -650,7 +650,7 @@ and its KMS and PGP keys are used to encrypt the file. It should be noted that
|
|||
the looking up of ``.sops.yaml`` is from the working directory (CWD) instead of
|
||||
the directory of the encrypting file (see `Issue 242 <https://github.com/mozilla/sops/issues/242>`_).
|
||||
|
||||
The path_regex checks the path of the encrypting file relative to the .sops.yaml config file. Here is another example:
|
||||
The path_regex checks the full path of the encrypting file. Here is another example:
|
||||
|
||||
* files located under directory **development** should use one set of KMS A
|
||||
* files located under directory **production** should use another set of KMS B
|
||||
|
|
|
|||
|
|
@ -8,9 +8,7 @@ import (
|
|||
"io/ioutil"
|
||||
"os"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/sirupsen/logrus"
|
||||
"go.mozilla.org/sops/v3"
|
||||
|
|
@ -315,20 +313,12 @@ func parseDestinationRuleForFile(conf *configFile, filePath string, kmsEncryptio
|
|||
return config, nil
|
||||
}
|
||||
|
||||
func parseCreationRuleForFile(conf *configFile, confPath, filePath string, kmsEncryptionContext map[string]*string) (*Config, error) {
|
||||
func parseCreationRuleForFile(conf *configFile, filePath string, kmsEncryptionContext map[string]*string) (*Config, error) {
|
||||
// If config file doesn't contain CreationRules (it's empty or only contains DestionationRules), assume it does not exist
|
||||
if conf.CreationRules == nil {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
configDir, err := filepath.Abs(filepath.Dir(confPath))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// compare file path relative to path of config file
|
||||
filePath = strings.TrimPrefix(filePath, configDir + string(filepath.Separator))
|
||||
|
||||
var rule *creationRule
|
||||
|
||||
for _, r := range conf.CreationRules {
|
||||
|
|
@ -366,8 +356,7 @@ func LoadCreationRuleForFile(confPath string, filePath string, kmsEncryptionCont
|
|||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return parseCreationRuleForFile(conf, confPath, filePath, kmsEncryptionContext)
|
||||
return parseCreationRuleForFile(conf, filePath, kmsEncryptionContext)
|
||||
}
|
||||
|
||||
// LoadDestinationRuleForFile works the same as LoadCreationRuleForFile, but gets the "creation_rule" from the matching destination_rule's
|
||||
|
|
|
|||
|
|
@ -75,15 +75,6 @@ creation_rules:
|
|||
hc_vault_uris: https://foz:443/v1/foz/keys/foz
|
||||
`)
|
||||
|
||||
var sampleConfigWithAmbiguousPath = []byte(`
|
||||
creation_rules:
|
||||
- path_regex: foo/*
|
||||
kms: "1"
|
||||
pgp: "2"
|
||||
gcp_kms: "3"
|
||||
hc_vault_uris: http://4:8200/v1/4/keys/4
|
||||
`)
|
||||
|
||||
var sampleConfigWithGroups = []byte(`
|
||||
creation_rules:
|
||||
- path_regex: foobar*
|
||||
|
|
@ -308,7 +299,7 @@ func TestLoadConfigFileWithGroups(t *testing.T) {
|
|||
}
|
||||
|
||||
func TestLoadConfigFileWithNoMatchingRules(t *testing.T) {
|
||||
_, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithNoMatchingRules, t), "/conf/path", "foobar2000", nil)
|
||||
_, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithNoMatchingRules, t), "foobar2000", nil)
|
||||
assert.NotNil(t, err)
|
||||
}
|
||||
|
||||
|
|
@ -331,51 +322,51 @@ func TestLoadConfigFileWithComplicatedRegexp(t *testing.T) {
|
|||
}
|
||||
|
||||
func TestLoadEmptyConfigFile(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleEmptyConfig, t), "/conf/path", "foobar2000", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleEmptyConfig, t), "foobar2000", nil)
|
||||
assert.Nil(t, conf)
|
||||
assert.Nil(t, err)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithEmptyCreationRules(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithEmptyCreationRules, t), "/conf/path", "foobar2000", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithEmptyCreationRules, t), "foobar2000", nil)
|
||||
assert.Nil(t, conf)
|
||||
assert.Nil(t, err)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithOnlyDestinationRules(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithOnlyDestinationRules, t), "/conf/path", "foobar2000", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithOnlyDestinationRules, t), "foobar2000", nil)
|
||||
assert.Nil(t, conf)
|
||||
assert.Nil(t, err)
|
||||
}
|
||||
|
||||
func TestKeyGroupsForFile(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "foobar2000", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "foobar2000", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "2", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "1", conf.KeyGroups[0][1].ToString())
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "whatever", nil)
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "whatever", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString())
|
||||
}
|
||||
|
||||
func TestKeyGroupsForFileWithPath(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "/conf/path", "foo/bar2000", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "foo/bar2000", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "2", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "1", conf.KeyGroups[0][1].ToString())
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "/conf/path", "somefilename.yml", nil)
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfigWithPath, t), "somefilename.yml", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "baggins", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "bilbo", conf.KeyGroups[0][1].ToString())
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "/conf/path", "whatever", nil)
|
||||
conf, err = parseCreationRuleForFile(parseConfigFile(sampleConfig, t), "whatever", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString())
|
||||
}
|
||||
|
||||
func TestKeyGroupsForFileWithGroups(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithGroups, t), "/conf/path", "whatever", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithGroups, t), "whatever", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "bar", conf.KeyGroups[0][0].ToString())
|
||||
assert.Equal(t, "foo", conf.KeyGroups[0][1].ToString())
|
||||
|
|
@ -384,39 +375,31 @@ func TestKeyGroupsForFileWithGroups(t *testing.T) {
|
|||
}
|
||||
|
||||
func TestLoadConfigFileWithUnencryptedSuffix(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "/conf/path", "foobar", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "foobar", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "_unencrypted", conf.UnencryptedSuffix)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithEncryptedSuffix(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "/conf/path", "barfoo", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithSuffixParameters, t), "barfoo", nil)
|
||||
assert.Nil(t, err)
|
||||
assert.Equal(t, "_enc", conf.EncryptedSuffix)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithUnencryptedRegex(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "/conf/path", "barbar", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "barbar", nil)
|
||||
assert.Equal(t, nil, err)
|
||||
assert.Equal(t, "^dec:", conf.UnencryptedRegex)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithEncryptedRegex(t *testing.T) {
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "/conf/path", "barbar", nil)
|
||||
conf, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithRegexParameters, t), "barbar", nil)
|
||||
assert.Equal(t, nil, err)
|
||||
assert.Equal(t, "^enc:", conf.EncryptedRegex)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithInvalidParameters(t *testing.T) {
|
||||
_, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithInvalidParameters, t), "/conf/path", "foobar", nil)
|
||||
assert.NotNil(t, err)
|
||||
}
|
||||
|
||||
func TestLoadConfigFileWithAmbiguousPath(t *testing.T) {
|
||||
config := parseConfigFile(sampleConfigWithAmbiguousPath, t)
|
||||
_, err := parseCreationRuleForFile(config, "/foo/config", "/foo/foo/bar", nil)
|
||||
assert.Nil(t, err)
|
||||
_, err = parseCreationRuleForFile(config, "/foo/config", "/foo/fuu/bar", nil)
|
||||
_, err := parseCreationRuleForFile(parseConfigFile(sampleConfigWithInvalidParameters, t), "foobar", nil)
|
||||
assert.NotNil(t, err)
|
||||
}
|
||||
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче